← Back to the live CVE advisory feed

CVE-2026-94127: BIG-IP

Severity

9.3 (CRITICAL)

Vendor

F5

Affected versions

21.1.0 through before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; 17.5.0 through before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; 17.1.

Patch status

Unknown

Published

2026-09-22T15:17:24.313

Modified

2026-09-23T04:17:58.180

Exploitation

Known exploited in the wild

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

View the official NVD record for CVE-2026-94127

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.